This vulnerability affects various Siemens RUGGEDCOM RM1224 LTE(4G) EU and NAM models, SCALANCE M and S series routers, and other related devices running firmware versions earlier than V8.2.1 or V3.2. The root cause is improper username validation during OpenVPN authentication, where partial invalid usernames can be accepted by the server. This partial string comparison flaw could potentially allow an attacker to bypass strict username checks. The CVSS v3.1 base score is 3.7, reflecting low severity with network attack vector, high attack complexity, no privileges required, and no user interaction needed. Siemens has provided an official patch to remediate this vulnerability.

The vulnerability allows an attacker to authenticate with partially invalid usernames during OpenVPN authentication, which could lead to limited unauthorized access or bypass of username validation controls. There is no direct impact on confidentiality or availability reported, and no known exploits in the wild have been documented. The overall impact is considered low severity.

An official fix is available from Siemens. Users and administrators of affected Siemens RUGGEDCOM and SCALANCE devices should upgrade to firmware version V8.2.1 or later (or V3.2 or later for specified SCALANCE models) to remediate this vulnerability. Applying the vendor-provided patch is the recommended and effective mitigation.